Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

140 - Project Secrets as Files #155

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

bryopsida
Copy link
Contributor

@bryopsida bryopsida commented Jun 1, 2024

What this PR does / why we need it:

This PR adds a value option enableSecretsAsFiles which is disabled by default, but when enabled toggles the rendered manifests to not use secrets as environment variables.

This addresses this CIS benchmark finding from the trivy operator. In additions to some of the other benchmarks trivy supports

Which issue this PR fixes

fixes: #140

Evidence

TODO add trivy report with default values
TODO add trivy report with custom values

TODO

  • Update admin hash init container to follow the option
  • Update couchdb container to follow the behavior for setting admin user, password, erlang cookie, and couchdb secret
  • Update probes to use a .netrc file when chttpd.require_valid_user and enableSecretsAsFiles are true
  • Rebase/squash to single commit once everything looks good.

Special notes for your reviewer:

Checklist

[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.

  • Chart Version bumped
  • e2e tests pass
  • Variables are documented in the README.md
  • NEWS.md updated

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Option to project secrets as files
1 participant